Vendor-level disclosure
1Vendors
The vendors below process data on behalf of BitStage as part of delivering the platform. This list is maintained at the vendor level - internal implementation details such as individual AWS services are covered under Amazon Web Services.
| Provider | Purpose | Data processed / location |
|---|---|---|
| Amazon Web Services | Cloud hosting, storage, database infrastructure, backups, security and operational infrastructure | All data, in US (us-east-1) and Canadian (ca-central-1) regions |
| AWS SES | Transactional email delivery | Account email addresses, transactional message content |
| Stripe | Payment processing for Client subscriptions | Billing and payment-method tokens only, and we do not see card numbers |
| HeyGen | AI avatar generation and rehearsal delivery | Scenario prompts and avatar outputs only, with no Candidate biometric data sent |
| LiveKit | Real-time audio/video streaming during active avatar sessions | Live audio and video streams via HeyGen Live Avatar, not persisted on LiveKit |
| Deepgram | Speech-to-text transcription | Audio segments and transcripts; US-based processing |
| Cartesia | Real-time text-to-speech and voice synthesis | AI interviewer voice during live rehearsal sessions, with no Candidate biometric identifiers sent |
| Recall.ai | Meeting bot recording and transcript capture, where enabled | Interview/meeting metadata, audio/video, transcripts, and recording status |
| OpenRouter | Structured AI analysis, feedback, scoring support, and evidence extraction | LLM gateway for schema-constrained text and transcripts, with no identification biometrics sent, primarily US-based |
| Langfuse | LLM observability, tracing, and cost monitoring | Prompt/completion telemetry for AI runtime quality and spend control |
| Google Analytics 4 | Aggregated website usage analytics | Pseudonymous usage data; consent-gated; IP-truncation enabled |
| Google OAuth / Google APIs | Authentication and calendar/Meet scheduling | Account authentication tokens and calendar data |
| LinkedIn OAuth | Authentication | Account authentication tokens |
| FingerprintJS | Device/browser fingerprinting for guest session linking, Resume Analyzer fair-use limits, and abuse prevention | Pseudonymous visitor IDs and hashed device/browser telemetry |
| Sentry | Error monitoring and diagnostics | Pseudonymous diagnostic and error-event data |
| Slack | Internal operational alerting | Ops/security webhook notifications; not Candidate-facing |
What we do not list separately
2How we manage Subprocessors
BitStage engages third-party Subprocessors only where necessary to deliver the Service. All Subprocessors must agree to data-protection terms at least as protective as those in the Privacy Policy.
Material changes to this list are communicated to Clients with active subscriptions at least thirty (30) days in advance. Clients may object on reasonable grounds, as set out in the Privacy Policy and applicable Data Processing Addendum.
For the full legal context - including data categories processed and cross-border transfer notices - see Subprocessors in the Privacy Policy (Section 8) and Subprocessors in the Terms of Service (Section 10).
3Contact
Questions about Subprocessors, vendor due diligence, or enterprise security documentation?
Email info@bitstage.ai for privacy inquiries, or info@bitstage.ai for security and compliance documentation.